New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 595738 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , All , Mac
Pri: 2
Type: Bug-Regression



Sign in to add a comment

JSON.stringify() throws error about circular structures in a Backbone Model

Reported by ryancmcc...@gmail.com, Mar 17 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

Steps to reproduce the problem:
1. visit https://jsfiddle.net/t7pn974a/1/
2. click "Run"
3. JSON.stringify() will throw this error 
"Uncaught TypeError: Converting circular structure to JSON"

What is the expected behavior?
The stringify() should execute without an error.

What went wrong?
Chrome v48, IE11, and Firefox v43 will execute the stringify() without any errors.

It looks like this issue only occurs if the model is set up in the same way as in the jsfiddle. Specifically, the toJSON() function on the model has to be bound to "this", and the model has to have a change event.

Did this work before? Yes Chrome v48

Chrome version: 49.0.2623.87  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 21.0 r0

If you put a dummy "replacer" function in the stringify() call, the issue does not occur.

var replacer = function (key, value) {
   return value;
}
JSON.stringify(model, replacer);
 
Cc: ranjitkan@chromium.org zhengxin...@intel.com
Labels: -Type-Bug M-51 has-Bisect OS-Linux OS-Mac Type-Bug-Regression
Owner: weiliangc@chromium.org
Status: Assigned (was: Unconfirmed)
Able to reproduce the issue and is a regression broken in M49 for Windows, MAC and Ubuntu OS. below are the bisect Details below:

Bisect Details:
===============
49.0.2605.0 - Good Build
49.0.2606.3 - Bad build

Change Log:
===========
https://chromium.googlesource.com/chromium/src/+log/06c3bd3beabbd81d6036aa207e633f9bec66233a..75c7843dcb738620b94332bc4d744dcdf38dbdec

V8 change Log:
==============
https://chromium.googlesource.com/v8/v8/+log/eae61813..951fd121

Suspecting the below change could be the possible suspect, @weiliangc: Request you to please take a look into it. Please help us to reassign if not with respect to this change.

https://chromium.googlesource.com/v8/v8/+/37d1dd823baa754ba45510c5a71236a29f72423b

Review URL: https://codereview.chromium.org/1548253002
Cc: weiliang...@intel.com
Owner: bmeu...@chromium.org
Wrong person. cc'ed the Intel reviewer.
Components: -Blink Blink>JavaScript
Status: Started (was: Assigned)
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/cc04776632834726aefcf8914ef5fb1ebb745a93

commit cc04776632834726aefcf8914ef5fb1ebb745a93
Author: bmeurer <bmeurer@chromium.org>
Date: Sun Mar 20 19:34:55 2016

[json] Allow any callable object for toJSON.

Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG= chromium:595738 ,  chromium:535408 
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}

[modify] https://crrev.com/cc04776632834726aefcf8914ef5fb1ebb745a93/src/json-stringifier.h
[add] https://crrev.com/cc04776632834726aefcf8914ef5fb1ebb745a93/test/mjsunit/regress/regress-crbug-595738.js

Labels: M-49 M-50 Arch-All OS-All
Status: Fixed (was: Started)

Comment 7 by japhet@chromium.org, May 23 2016

 Issue 613863  has been merged into this issue.

Sign in to add a comment